# CVE-2026-20167: Cisco IoT Field Network Director DoS in managed routers

Source: https://junglewise.ai/threats/cve-2026-20167-cisco-iot-field-network-director-dos-in-managed-routers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-06. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-20167 · Severity: high · CVSS 7.7 · Published 2026-05-06

Cisco IoT Field Network Director is a management platform used to monitor and control large-scale industrial networks and smart grid devices. A vulnerability in its web interface allows a logged-in user with low-level permissions to crash a connected router. This could lead to network outages and service disruptions in critical infrastructure environments.

Technologies: [Cisco Iot Field Network Director](https://junglewise.ai/threats/technologies/iot-field-network-director). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20167 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20167 being exploited in the wild.

**How severe is CVE-2026-20167?** High severity, with a CVSS score of 7.7, published 6 May 2026.

**Which products and versions are affected?** Cisco Iot Field Network Director All versions prior to 5.0.0-117.

**Is there a fix for CVE-2026-20167?** A patch was published on 2026-05-06. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20167 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20167?** Check whether you run Cisco Iot Field Network Director at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) stems from improper error handling when processing user-supplied input. An authenticated, remote attacker with low privileges can exploit this by submitting crafted input to the interface. A successful exploit allows the attacker to request unauthorized files from a managed router, which triggers a reload of the router's operating system. This results in a Denial of Service (DoS) condition on the managed hardware. The vulnerability is tracked under Cisco Bug ID CSCwm81015 and has been addressed in version 5.0.0-117.

## Affected products

- Cisco IoT Field Network Director (IoT-FND) All versions prior to 5.0.0-117

## Timeline

- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-05-06: patched

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iot-fnd-dos-n8N26Q4u](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iot-fnd-dos-n8N26Q4u)

## Related threats

- [Cisco IoT Field Network Director command injection in web interface](https://junglewise.ai/threats/cve-2026-20169-cisco-iot-field-network-director-command-injection-in-web)
- [Cisco IoT Field Network Director path traversal in web management interface](https://junglewise.ai/threats/cve-2026-20168-cisco-iot-field-network-director-path-traversal-in-web-management)